CVE-2023-6432

Summary

CVE-2023-6432 is a newly identified vulnerability in BigProf Online Invoicing System 2.6. It arises due to insufficient input encoding, leaving the door open for persistent Cross-Site Scripting (XSS) attacks. An attacker can exploit this vulnerability by manipulating the FirstRecord parameter in the /inventory/items_view.php page. Successful exploitation enables the attacker to inject malicious JavaScript code, which is executed when the page loads. This could lead to unintended actions or theft of sensitive information from unsuspecting users.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.